fix(apply): scope COSI preflight ctx to singular node key

The auth template-rendering apply path puts the target node under
the plural "nodes" metadata key so helpers.ForEachResource and
apid's machine-API backend resolver can read it. Reusing that ctx
for the COSI version preflight breaks the preflight: Talos's apid
director rejects every COSI method whose outgoing context carries
the plural key, regardless of slice length, and cosiVersionReader
swallows errors and returns ok=false on rejection. End user sees
no version-mismatch warning even when the running Talos predates
the configured talosVersion -- defeating the whole point of the
preflight added in PR #133.

Add cosiPreflightContext: clone the outgoing metadata, drop
"nodes", attach "node" with the same target, hand the rebuilt
context to the COSI caller. ApplyConfiguration keeps the original
ctx unchanged. The helper is a noop on the insecure (maintenance)
path that carries no node metadata at all and on multi-node ctx
where the single-target shortcut would be unsafe.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/commands/apply.go

@@ -24,6 +24,7 @@ import (
 
 	"github.com/cozystack/talm/pkg/engine"
 	"github.com/spf13/cobra"
+	"google.golang.org/grpc/metadata"
 	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/siderolabs/talos/cmd/talosctl/pkg/talos/helpers"
@@ -122,15 +123,25 @@ func apply(args []string) error {
 			fmt.Printf("- talm: file=%s, nodes=%s, endpoints=%s\n", configFile, nodes, GlobalArgs.Endpoints)
 
 			applyClosure := func(ctx context.Context, c *client.Client, data []byte) error {
-				// ctx here is single-target on every apply path: the auth
-				// branch sets `nodes` (plural, one element) via
-				// openClientPerNodeAuth (apid treats len("nodes") == 1 as
-				// single-target); the insecure branch goes through a fresh
-				// per-node maintenance client whose ctx carries no node
-				// metadata at all, but the maintenance client itself dials
-				// a single endpoint per call. COSI reads are safe under
-				// either shape.
-				preflightCheckTalosVersion(ctx, cosiVersionReader(c), applyCmdFlags.talosVersion, os.Stderr)
+				// ctx is shaped for ApplyConfiguration on every apply path:
+				// the auth branch sets `nodes` (plural, one element) via
+				// openClientPerNodeAuth so apid resolves a single backend
+				// and helpers.ForEachResource can read the plural key from
+				// inside template lookups; the insecure branch carries no
+				// node metadata at all and the maintenance client dials a
+				// single endpoint per call.
+				//
+				// The COSI preflight needs a different context shape:
+				// Talos's apid director rejects every COSI method whose
+				// ctx carries the plural "nodes" key, regardless of slice
+				// length (its COSI guard is unconditional). cosiVersionReader
+				// swallows errors and returns ok=false on rejection, so the
+				// preflight would silently no-op on the auth path — defeating
+				// the whole point of preflightCheckTalosVersion (PR #133).
+				// cosiPreflightContext rebuilds ctx with the singular "node"
+				// key so the COSI router accepts the call; ApplyConfiguration
+				// keeps the original ctx unchanged.
+				preflightCheckTalosVersion(cosiPreflightContext(ctx), cosiVersionReader(c), applyCmdFlags.talosVersion, os.Stderr)
 
 				resp, err := c.ApplyConfiguration(ctx, &machineapi.ApplyConfigurationRequest{
 					Data:           data,
@@ -378,6 +389,38 @@ func openClientPerNodeAuth(parentCtx context.Context, c *client.Client) openClie
 	}
 }
 
+// cosiPreflightContext returns a context suitable for a COSI call
+// against the same single target the caller's ctx addresses on the
+// machine API. Talos's apid director rejects every COSI method whose
+// outgoing context carries the plural "nodes" metadata key, regardless
+// of how many entries the slice has — the COSI router insists on the
+// singular "node" key. The auth template-rendering apply path uses
+// client.WithNodes (plural, single-element slice) so that
+// helpers.ForEachResource and the apid backend resolver can both read
+// the plural key from template lookups; that ctx is therefore
+// unsuitable for COSI reads as is.
+//
+// The fix is local to the COSI preflight: clone the outgoing
+// metadata, drop "nodes", attach "node" with the same target, and
+// hand the rebuilt context to the COSI caller. ctx is unchanged for
+// the insecure (maintenance) path that carries no node metadata at
+// all, and unchanged when the auth path's plural slice has a length
+// other than one (multi-node scenarios already error out earlier in
+// applyTemplatesPerNode, but the helper is defensive).
+func cosiPreflightContext(ctx context.Context) context.Context {
+	md, ok := metadata.FromOutgoingContext(ctx)
+	if !ok {
+		return ctx
+	}
+	nodes := md.Get("nodes")
+	if len(nodes) != 1 {
+		return ctx
+	}
+	mdClone := md.Copy()
+	mdClone.Delete("nodes")
+	return client.WithNode(metadata.NewOutgoingContext(ctx, mdClone), nodes[0])
+}
+
 // resolveAuthTemplateNodes returns the node list the authenticated
 // template-rendering path should iterate over. cliNodes (from --nodes
 // or the modeline) takes precedence; when empty, the talosconfig

pkg/commands/apply_test.go

@@ -697,6 +697,71 @@ func TestApplyTemplatesPerNode_AuthModeUsesPluralNodesMetadataKey(t *testing.T)
 	}
 }
 
+// TestCosiPreflightContext_StripsPluralAndAttachesSingular pins the
+// COSI preflight ctx contract: the auth template-rendering apply path
+// puts the target node under the plural "nodes" metadata key (so
+// helpers.ForEachResource and apid's machine-API backend resolver can
+// read it), but Talos's apid director rejects every COSI method whose
+// outgoing context carries the plural key, regardless of slice
+// length. cosiPreflightContext rebuilds ctx with the singular "node"
+// key so the COSI router accepts the call. Without this, the version
+// preflight added in PR #133 silently no-ops on the auth path:
+// cosiVersionReader swallows errors and returns ok=false on rejection.
+func TestCosiPreflightContext_StripsPluralAndAttachesSingular(t *testing.T) {
+	const node = "10.0.0.1"
+	in := client.WithNodes(context.Background(), node)
+
+	out := cosiPreflightContext(in)
+
+	md, ok := metadata.FromOutgoingContext(out)
+	if !ok {
+		t.Fatal("expected outgoing metadata on preflight ctx")
+	}
+	if got := md.Get("nodes"); len(got) != 0 {
+		t.Errorf(`metadata key "nodes" must be unset on COSI preflight ctx, got %v (apid's COSI router rejects every call carrying it)`, got)
+	}
+	if got := md.Get("node"); !slices.Equal(got, []string{node}) {
+		t.Errorf(`metadata key "node" = %v, want [%q] (apid's COSI router routes by the singular key)`, got, node)
+	}
+}
+
+// TestCosiPreflightContext_LeavesNoMetadataAlone pins the noop case
+// for the insecure (maintenance) apply path, whose ctx carries no
+// outgoing metadata at all — the maintenance client dials a single
+// endpoint per call and routing-by-key is irrelevant. The helper
+// must return ctx unchanged, not synthesize an empty "node" key
+// that apid would route to the wrong target.
+func TestCosiPreflightContext_LeavesNoMetadataAlone(t *testing.T) {
+	in := context.Background()
+	out := cosiPreflightContext(in)
+
+	if md, ok := metadata.FromOutgoingContext(out); ok && len(md) > 0 {
+		t.Errorf("expected no outgoing metadata on preflight ctx for maintenance path, got %v", md)
+	}
+}
+
+// TestCosiPreflightContext_LeavesMultiNodeAlone pins the defensive
+// branch for plural slices with a length other than one: the
+// applyTemplatesPerNode loop runs one iteration per node, so plural
+// metadata should always be a single-element slice in production,
+// but the helper must not silently collapse a multi-element slice
+// into a fabricated single-target call.
+func TestCosiPreflightContext_LeavesMultiNodeAlone(t *testing.T) {
+	in := client.WithNodes(context.Background(), "a", "b")
+	out := cosiPreflightContext(in)
+
+	md, ok := metadata.FromOutgoingContext(out)
+	if !ok {
+		t.Fatal("expected outgoing metadata on preflight ctx")
+	}
+	if got := md.Get("nodes"); !slices.Equal(got, []string{"a", "b"}) {
+		t.Errorf(`expected "nodes" passthrough on multi-node ctx, got %v`, got)
+	}
+	if got := md.Get("node"); len(got) != 0 {
+		t.Errorf(`expected no synthesized "node" on multi-node ctx, got %v`, got)
+	}
+}
+
 // TestTemplateAndApplyDiverge_NodeBodyOverlayLimitation pins a known
 // trade-off: `talm apply -f node.yaml` overlays the node file body on the
 // rendered template before sending the result to ApplyConfiguration, but